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United States District Court for the 
District of Columbia 



FILED 

OCT 2 6 2004 



NANCY MAY© WHfTTINGTON, CLERK 
U.S. DISTRICT COURT 



OMB Watch 

1742 Connecticut Avenue, N.W. 

Washington, DC 20009 

and 

ELECTRONIC PRIVACY ' INFORMATION CENTER 
1718 Connecticut Avenue, N.W., Suite 200 
Washington, DC 2 0009, 

Plaintiffs, 



CASE : 



v. 



DEPARTMENT OF HOMELAND SECURITY 
Washington, DC 20528, 
Defendant . 



JUDGE ■ ,T«^ e ,. n f 

- ua.tu&s, Kobe f t snp 

DATE emuun . , 



COMPLAINT FOR INJUNCTIVE RELIEF 

1. This is an action under the Freedom of Information Act 
("FOlA"), 5 U.S.C. § 552, for injunctive and other appropriate 
relief, seeking the release of agency records detailing the 
Department of Homeland Security's ( ^DHS" ) compliance with its 
statutory duty to implement the Critical Infrastructure 
Information Act ("CIIA"), 6 U.S.C. § 133. 



Jurisdiction and Venue 
2. This court has both subject matter jurisdiction over 
this action and personal jurisdiction over the parties pursuant 
to 5 U.S.C. § 552(a) (4) (B) . This court also has jurisdiction 
over this' action, pursuant to 28 U.S.C § 1331. Venue is proper 
in this district under 5 U.S.C. § 552 (a) (4) (B) . 
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Parties 

3 . Plaintiff OMB Watch is a non-profit research and 
advocacy organization incorporated in Washington, DC. OMB Watch 
is dedicated to promoting government accountability and citizen 
participation in public policy decisions. This mission centers 
on four main areas: the federal budget, regulatory policy, public 
access to government information, and public participation by 
non-profit organizations. OMB Watch maintains a website 
{www.ombwatch.org) containing extensive information on these 
issues, including information OMB Watch has obtained from federal 
agencies under the POIA. 

4. Plaintiff Electronic Privacy Information Center 
("EPIC") is a public interest research organization incorporated 
as a not-for-profit corporation in Washington, DC. EPIC's 
activities include the review of federal law enforcement 
activities and policies to determine their possible impacts on 
civil liberties and privacy interests. Among its other 
activities, EPIC publishes books, reports, and a bi-weeklv 
electronic newsletter. EPIC also maintains a heavily-visited 
website (www.epic.org) containing extensive information on 
privacy issues, including information EPIC has obtained from 
federal agencies under the FOIA. 

5. Defendant DHS is a Department of the Executive Branch 
of the United States government. DHS is an agency within the 
meaning of 5 U.S-C. § 552(f) . DHS was created by the Homeland 
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Security Act of 2002. 6 U.S.C. § ill. Among its other duties, 
DHS must implement the CIIA. 6 U.S.C. §. 133(e). 

The Critical Infrastructure Information Act 

6 . The CIIA requires DHS to collect and protect 
voluntarily submitted information which is "not customarily in 
the public domain and related to the security of critical 
infrastructure or protected systems." 6 U.S.C. § 131(3). This 
information is protected by the CIIA from disclosure 
requirements, including the FOIA. 6 U.S.C. § 133(a)(1). 

7. The CIIA also required DHS to "establish uniform 
procedures for the receipt, care, and storage" of voluntarily 
submitted Critical Infrastructure Information ("CII") no later 
than 90 days after November 25, 2002. 6 U.S.C. § 133(e) (1). To 
comply with its statutory duty, DHS should have developed those 
procedures by early 2003, but it did not publish its interim rule 
until February 20, 2004. 69 Fed. Reg. 8,073 (Feb. 20, 

2004) (codified at 6 C.F.R. pt . 29). 

S. Information customarily in the public domain cannot be 
protected from disclosure by the CIIA. See 6 U.S.C. § 131(3). 
Thus, information about DHS's methods for implementing the CIIA 
and tracking submissions, as well as aggregate data regarding 
submissions are not protected from disclosure by the CIIA. 
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Plaintiffs' Request and Defendant's Response 

9. By letter dated April 16, 2004, Plaintiffs sent a 
request under the FOIA to Elizabeth Withnell, Departmental 
Disclosure Officer of DHS . The request was sent via certified 
mail and signed for by Elizabeth Withnell on April 22, 2004. A 
copy of that letter and the certified mail receipt are attached 
to this Complaint as Exhibit 1 . 

10. Plaintiffs' April 16, 2004 request conformed to 
Defendant ' s FOIA requirements . 

11 . Plaintiffs requested records relating to the 
implementation of the CIIA, including the following : 

i. records in the custody of DHS that index CII, 
including CII submitted to DHS by other Federal 
Agencies, United States government contractors, 
Foreign, State, and local governments, and government 
authorities, including, but not limited to: 

a) date of receipt, 

b) name of submitter, 

c) description of information, 

d) manner of acknowledgment, 

e) tracking number, and 

f) validation status; 

ii . written communications submitted by a "person or 

entity," as defined by the CIIA, requesting that 

accompanying information be deemed Protected CII, 

including, but not limited to: 

a) express statements, as identified in 6 C.F.R 
§ 29.5 (a) (3) , and 
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b) certification statements, as identified in 6 
C.F.R. § 29.5 (a) (4) ; 

iii. written communications to a person or entity- 
acknowledging the receipt of a request that 
information be deemed Protected CII; 

iv. written communications from a person or entity 
regarding the status of a person's or entity's request 
that information be deemed protected CII; 

v. written communications to a person or entity 
regarding the status of a person's or entity's request 
that information be deemed Protected CII; 

vi . copies of information submitted by a person or 
entity where the information was deemed non-CII or 
non- Protected CII; 

vii. written communications explaining any interim 
procedures in effect prior to the promulgation of the 
interim rule for the receipt, care, and storage of CII 
by all Federal agencies, United States government 
contractors, Foreign, State, and local governments, 
and government authorities; 

viii. written communications submitted to DHS by 
other Federal agencies, United States government 
contractors, Foreign, State, and local governments, 
and. government authorities concerning the application 
or scope of the CIIA to their actions; 

ix. written communications submitted by DHS to 
Federal agencies, United States government 
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contractors, Foreign, State, and local governments, 
and government authorities concerning the application 
or scope of the CIIA to their actions ,- 

x. written communications responding to an inquiry 
from a person or entity that explain the interim 
procedures in effect prior to the promulgation of the 
interim rule for a person or entity to submit CII to 
DHS; and 

xi . written materials regarding the operation of the 
software program that will be used to track requests 
that information be deemed CII and protected 
accordingly, including, but not limited to: 

a) the data dictionary used to construct the 
software program, and 

b) software manuals. 

12. By letter dated June 8, 2004, Defendant, by its agent, 
J. A. Kendrick, Director of Departmental Disclosure of DHS, 
acknowledged receipt of Plaintiffs' April IS, 2004 request. In 
that letter, Defendant stated that it was "referring [the] 
request to the FOIA Officer for the Information Analysis and 
Infrastructure Protection (IAIP) , Sue Armstrong at fax number 
202-282-8802 for processing and direct response to [Plaintiffs] ." 

13. Defendant's June 8, 2004 letter was postmarked on June 
10, 2004 and sent via regular mail. Plaintiffs received the ■ 
letter on June 16, 2004. 

14. On September 17, 2004, Plaintiffs telephoned Sandy 
Ford, Disclosure Officer for the IAIP Directorate of DHS, to 
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determine the status of the April 16, 2004 request. Ms. Ford 
informed Plaintiffs that Defendant had no record of the request. 
At Ms. Ford's suggestion, on September 17, 2 004, Plaintiffs sent 
a facsimile to her attention with a copy of the request and a 
copy of the delivery confirmation card. 

15. By letter dated September 20, 2004, Ms. Ford 
acknowledged receipt of the facsimile. By providing Plaintiffs 
with a new reference number in that letter, Ms. Ford implied that 
Defendant considered the request new. The letter noted that 
Defendant "processes FOIA requests according to their order of 
receipt . " 

16. To date, Defendant has not provided the requested 
records to Plaintiffs. 



CAUSE OF ACTION 

Defendant Has Violated the FOIA by 
Failing to Timely Respond to Plaintiffs' Request 

17. By letter dated April 16, 2004, Plaintiffs requested 
records from Defendant under the FOIA. Defendant received 
Plaintiffs' April 16, 2004 request on April 22, 2004. Thus, 
Defendant should have responded no later than May 20, 2 004. 

18. In a letter dated June 8, 2004, Defendant acknowledged 
receipt of Plaintiffs' April 16, 2004 request and stated that it 
would process the request . 
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19. To date, Defendant has not provided the requested 
records to Plaintiffs, notwithstanding the FOIA' s requirement 
that an agency respond to a request within twenty (20) business 
days . 

20. Plaintiffs have exhausted the applicable 
administrative remedies. 

21. Defendant has improperly withheld the requested 
records from Plaintiffs . 

Demand for Relief 
WHEREFORE, Plaintiffs pray that this Court: 



A. order Defendant to disclose the requested records 
in their entirety and make copies available to 
Plaintiffs; 

B. provide for expeditious proceedings in this 
action; 

C. award Plaintiffs their costs and reasonable 
attorneys fees incurred in this action; and 

D. grant such other relief as the Court may deem just 
and proper. 



RENA STEINZOR / } 

D.C. Bar No. 962993 
UNIVERSITY OF MARYLAND 
ENVIRONMENTAL LAW CLINIC 
500 West Baltimore Street 



Respectfully Submitted on October 21, 2004, 
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Baltimore, MD 21201 
{410} 706-0564 

DAVID L. SOBEL 
D.C Bar No. 360418 

ELECTRONIC PRIVACY INFORMATION CENTER 
1718 Connecticut Avenue, N.W. , Suite 200 
Washington, DC 2 0009 
(202) 483-1140 



Counsel for Plaintiffs 
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CLINICAL LAW OFFICE 




UNIVERSITY OF MARYLAND 
■ SCHOOL OF LAW 



April 16, 2004 

CERTIFIED MAIL, RETURN RECEIPT REQUESTED 

Elizabeth R.Wimnell 
Departmental Disclosure Officer . 
Department of Homeland Security 
Washington, DC 20528 -■' 

Re: Freedom of Information Act Request for Critical Infrastructure Information Records 
Dear Ms. Withnell: 



This letter is a request for agency records under the Freedom of Information Act 
(TOLA), 5 U.S.C. § 552. On behalf of our clients, OMB Watch and the Electronic 
Privacy Information Center (EPIC), we request the following records concerning Critical 
Inrrastructure Information (CD), as defined by the Critical Infrastructure Information Act 
of 2002 (CII Act), 6 U.S.C. §§ 131-134: * .' ~ 

1. records in the custody of the Department of Homeland Security (DHS) that index 
CII, including CH submitted to the DHS by other Federal agencies, United States " 
government contractors, Foreign, State, and local governments, and government 
authorities, including, but not limited to: 

a) date of receipt, 

b) name of submitter, 

c) description of information, 

■ d) maimer of acknowledgment, 
• e) tracking number, and 
i) validation status; 



2. ■ written communications submitted by a "person or entity," as defined by the 
CII Act, requesting that accompanying information be deemed Protected CII. 
including, but not limited to, 



a) 
b) 



express statements, as identified in 6 CF.R. § 29.5(a)(3), and 
certification statements, as identified in 6 CF.R. § 29.5(a)(4); 



.500 West Baltimore Street 
Batemore, Iviaryland 21201-1786 
410 706 3295 gfrisral imormniian 
410 706 5856 fax 



Attorneys: 

Barbara L. Bezdefe 
Richard C. Boidt 
Douglss L. Colbert 
Karen Czapansfciy 



)orotrifi E. Dssse 
Terry Hickey 
Sherrilyr! A. Kill 
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3 . ■ written communications to a person or entity acknowledging the receipt of a 
request that information be deemed Protected CII; ■ 

■ 4. written communications from a person or entity regarding the status of a 
person' s or entity' s request that information be deemed Protected Gil; 

5. written communications to a person or entity regarding the status of a person's 
or entity's request that information be deemed Protected CII; 

6. copies of information submitted by a person or entity where the information 
was deemed non-CII or non-Protected CII respectively; 

7 . ■ written communications explaining any interim procedures in effect prior to 
the promulgation of the interim rule for the receipt, care, and storage of CII by dl 
Federal agencies, United States government contractors, Foreign, State, and local 
governments, and government authorities; 

8. "written communications submitted to the DHS by other Federal agencies, 
United States government contractors, Foreign, State; and local governments, and 
government authorities concerning the application or scope of the CII Act to their 
actions; 

9. written communications submitted by the DHS to Federal agencies, United 
States government contractors, Foreign, State, and local governments, and 
government authorities concerning the application or scope of the CD. Act to their 
actions; 

10. written communications responding to an inquiry from a person or entity that 
explain the interim procedures in effect prior to the promulgation of the interim rule 
for a person or entity to submit CJQ to the DHS; and 

11. written materials regarding the operation of the software program that will be 
used to track requests that information be deemed CH and protected accordingly, 
includingj but not limited to, 

a) the data dictionary used to construct the software program, and 

b) software manuals. 

If any part of this request is denied, please describe the nature of the records 
withheld and the reason for denying the release of such records. When responding, 
please reference the applicable FOIA exemption and the specific numbered request from 
above. 

In addition, as required by the FOIA, please release all segregable parts of the 
records that remain after the exempted material has been deleted "from the records we are 
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seeking. To expedite this request, we would be willing to discuss specific instances of 
deletions or other exemption claims in advance of the final decision of the agency. 

For purposes of fee assessment, we ask that this request be treated as one 
submitted by a "representative of the news media" under the FOIA and 6 C.F-R. § 5.11. 
OMB Watch and EPIC are public interest organizations that regularly publish and 
disseminate information relating to emerging policy issues. Indeed, the U.S. District 
Court for the District of Columbia has expressly held that EPIC is entitled to "news 
media" fee status. Electronic Privacy Information Center v. Department of Defense, 241 
F. Supp. 2d 5 (D.D.C. 2003). We further request a waiver of duplication fees for this 
request, as disclosure of the requested information is in the public interest because it is 
likely to contribute significantly to public understanding of the operations or activities of 
the government and is not for a commercial purpose. 

In the event you deny the request for a fee waiver^ we agree to pay reasonable . . 
duplication fees for the processing of this request. If the fees will exceed $1 50, please 
notify Rena Steinzor at (410) 706-0564 or rstem@law.umaryland.edu prior to incurring 
any expenses in excess of that amount. 

We look forward to your reply within 20 business days, as required by the FOIA. 
Thank you for your assistance. 

Sincerely, ; 

Rena I. Steinzor, ^ David L. Sobel, 

Director General Counsel 

Becky Lukaesko, . Electronic Privacy . 

Student Attorney* Information Center" 

University of Maryland . 
Environmental Law Clinic , 

Attorneys for OMB Watch 

* Practicing pursuant to Federal Rule 502. 
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m 'Complete items 1, 2, and 3. Also complete 

: item 4 if Restricted Delivery is desired. 
m Print your name and address on the reverse 
■ so that we can return the card to you. 
m Attach tniSi§pgGl to the back of the maiipiece, 
or on the front if space permits. 



:■: CPMPLET&THIS SECTIONfON ;DEUWEtm 



1 . Article Addressed to: s 

.Elizabeth R. Withnell 
Deptmental Disclosure Officer 

Dept . of Homeland Security 
Washington B.C. 20528 



7f; 7001.0320 OOD'H S5'4Q D3Sb 




B. Received by ( Printed Name) 



C. DateufDeliVi 

m 



□. Is delivery address different from Item 1 ? Q^yes 
If YES, enter delivery address below. \ja No 



Service Type 
i^&ertified Mali 
SWegistered 
□ Insured hAai! 



□ Express Mail 

□ Return Receipt fcr Merchandise , 

□ C.O.D. 



Restricted Delivery? (Extra Fee,l 



□ Yes 



PS Form 381 1 , AuguifW ( "^^*^%iklMet: 



:um Receipt 



! W If f t li it llijiii Isffefe-SlM 540 . 



United States Postal Service 



First-Class Mail 
Postage & Fees Paid 
USPS 

Permit Mo. G-10 ' 



Sender: PJease print your name, address, and 2IP+4 in this box • 



Renal Steinzor 

Director s Environmental Law Clinic . 
.University- of . Maryland School of Law- 
500 ¥.. Baltimore Street 
Baltimore, MD 21201-1786 ' ' 



